Quoting Steve Litt (slitt@???):

> I've found the way for Unbound itself to do simple on-subnet auth
> without a separate auth server, and will reveal them tomorrow.

That is doubtless the 'stub zone' functionality I mentioned in
http://linuxmafia.com/faq/Network_Other/dns-servers.html#unbound ,
after seeing it in the documentation. (I've never needed it, so never
read up on how it works.)